You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "dosubot[bot] (via GitHub)" <gi...@apache.org> on 2026/05/02 03:15:16 UTC
Re: [D] Apache Superset 6.0: Migration from Iframe Embedding to the Embedded SDK (@superset-ui/embedded-sdk) [superset]
GitHub user dosubot[bot] edited a comment on the discussion: Apache Superset 6.0: Migration from Iframe Embedding to the Embedded SDK (@superset-ui/embedded-sdk)
<!-- Answer -->
Great questions! Here are the best practices based on Superset's documentation and community experience:
**1. Role Selection: Create a Custom Dedicated Role**
The recommended approach is to create a custom "EmbedGuest" role via [`GUEST_ROLE_NAME`](https://github.com/apache/superset/discussions/33674#discussioncomment-13358282), not inherit from Gamma or Public:
```python
GUEST_ROLE_NAME = "EmbedGuest"
```
Important: [Superset ignores any roles specified in the guest_token payload](https://github.com/apache/superset/discussions/35670#discussioncomment-14695540) and always uses the role from `GUEST_ROLE_NAME`.
**2. Why NOT Gamma or Public?**
- **Public**: [If `GUEST_ROLE_NAME` isn't set, both unauthenticated users and guest-token users share Public permissions](https://github.com/apache/superset/discussions/33674#discussioncomment-13358282)—a security risk.
- **Gamma**: Contains excessive permissions (SQL Lab, export, editing) that embedded viewers shouldn't have.
**3. Minimum Viable Permissions for Public Role: ZERO**
For your Zero-Trust model, the Public role should have **no permissions**. The SDK bootstrap uses your custom guest role, not Public. [Manual changes to Public are overwritten on `superset init` or upgrade](https://github.com/apache/superset/discussions/37660#discussioncomment-15691832).
For your **EmbedGuest** role, [grant only these permissions](https://github.com/apache/superset/issues/36377#issuecomment-3605175485):
- `can_read`, `can_list`, `can_get` on Dashboard, Chart, Dataset, Database
- `can dashboard`, `can explore json` on Superset
- [`can log` on Superset](https://github.com/apache/superset/issues/36186) (often missed—required for `/superset/log`)
- [`can time range` on Api](https://github.com/apache/superset/issues/35073#issuecomment-3271818494) (required for time filters)
**4. Session Bleed: Known Limitation**
Yes, this is a [known issue](https://github.com/apache/superset/discussions/35231#discussioncomment-15065066). [There's no built-in way to isolate session cookies by path for different auth flows under the same domain](https://github.com/apache/superset/discussions/35231#discussioncomment-15065066).
**Workarounds:**
- Use **separate subdomains** for admin UI vs embedded dashboards
- Use separate browsers/incognito for testing
- Pick one auth flow per browser context
**Cookie settings for cross-origin embedding:**
```python
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True # Required with SameSite=None
SESSION_COOKIE_HTTPONLY = True
```
**Bonus tip for RLS**: In Superset 5.0+, [the `username` field in guest tokens MUST be non-empty](https://github.com/apache/superset/discussions/36494#discussioncomment-15222071)—empty usernames cause RLS rules to fail silently.
Let me know if you'd like a complete production config example or help troubleshooting specific 403 errors!
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=8da26480-cb63-4269-93a0-169290b7bfa9) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/38461#discussioncomment-16019303
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org